Skip to content

Conversation

@mrodm
Copy link
Contributor

@mrodm mrodm commented Oct 23, 2025

Fixes #2904

Add support to run system benchmarks in those packages that contain more than one input. And one of the other inputs not used in the system benchmark define any variable as required.

The current behaviour with the request performed, Fleet enabled all the inputs. If one of the inputs not used in the system benchmark defines that requires any variable, it could fail with an error of missing required variables.

As example, if it runs a system benchmark for the input httpjson for the sentinel_one package, it failed since the cel input contains some required variables and it is enabled:

"Package policy is invalid: inputs.cel.vars.url: URL is required\ninputs.cel.vars.api_token: API Token is required

This PR disables all the unused policy templates/inputs, and it just enables and configures the policy_template and input defined in the system benchmark.

  • Before (all policy templates enabled):
all policy templates enabled
  • After (just the one required in benchmark):
just one policy template enabled

Author's Checklist

  • Add test package with more than one input and run system benchmarks.
    • Added system_benchmark_sentinel_one containing more two inputs, and both of the inputs with required variables (copied from sentinel_one package in the integrations repository).
  • Run system benchmark in the current definitions found from integrations repository (e.g. panw, ti_abusech).
  • Update system benchmark documentation

@mrodm mrodm self-assigned this Oct 23, 2025
@mrodm mrodm force-pushed the system-benchmark-two-or-more-inputs branch from 95d7abb to 3dcbab5 Compare October 23, 2025 08:26
@mrodm mrodm force-pushed the system-benchmark-two-or-more-inputs branch from 873010c to 8e5c1b5 Compare October 24, 2025 14:30
@elasticmachine
Copy link
Collaborator

elasticmachine commented Oct 27, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

History

cc @mrodm

Comment on lines +174 to +185
// Set default values for scenario fields from package manifest if not set
if r.scenario.Version == "" {
r.scenario.Version = pkgManifest.Version
}

if r.scenario.Package == "" {
r.scenario.Package = pkgManifest.Name
}

if r.scenario.PolicyTemplate == "" {
r.scenario.PolicyTemplate = pkgManifest.PolicyTemplates[0].Name
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These checks/assignments were previously inside createPackagePolicy, it feels like they should be set earlier here to setup all the fields in the scenario variable.

Comment on lines +446 to +460
// By default, all policy templates are enabled when creating a package policy.
// This could lead to errors if other policy templates have required variables.
// Therefore, all other policy templates and inputs must be disabled since here
// just the variables for the current input are set.
// NOTE: This data is retrieved from the local package manifest.
for _, policyTemplate := range pkgManifest.PolicyTemplates {
for _, input := range policyTemplate.Inputs {
if policyTemplate.Name == r.scenario.PolicyTemplate && input.Type == r.scenario.Input {
continue
}
pp.Inputs[fmt.Sprintf("%s-%s", policyTemplate.Name, input.Type)] = kibana.PackagePolicyInput{
Enabled: false,
}
}
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Screenshots with examples of the explanation explained in the comment are posted in the description of the PR.

As mentioned in the comment, setting this policy templates as disabled is based on the manifests read from the files found in the package locally.
It follows the same approach as to choose the default policy template reading from the value from the manifest.

if r.scenario.PolicyTemplate == "" {
r.scenario.PolicyTemplate = pkgManifest.PolicyTemplates[0].Name
}

This would be something to check if it is required to use other package or versions as mentioned in the documentation:

| package | string | | The name of the package. If omitted will pick the current package, this is to allow for future definition of benchmarks outside of the packages folders. |
| description | string | | A description for the scenario. |
| version | string | | The version of the package to benchmark. If omitted will pick the current version of the package. |
| policy_template | string | | The policy template to test. If omitted will pick the first one. |

Vars: r.scenario.Vars,
Streams: map[string]kibana.PackagePolicyStream{
fmt.Sprintf("%s.%s", pkgManifest.Name, r.scenario.DataStream.Name): {
fmt.Sprintf("%s.%s", r.scenario.Package, r.scenario.DataStream.Name): {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, this was using directly pkgManifest.Name , is it ok to use r.scenario.Package instead ? @marc-gr

}
}

pp.Package.Name = r.scenario.Package
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, this was using directly pkgManifest.Name , is it ok to use r.scenario.Package instead ? @marc-gr

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mainly added notes in this documentation file in case developers are running system benchmark with local changes.

@mrodm mrodm marked this pull request as ready for review October 27, 2025 15:19
@mrodm mrodm requested review from a team and marc-gr October 27, 2025 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[system benchmarking] Package policy validation fails when having more than one input types

2 participants